CB Response: Different AV Product Blocked a Malicious Binary, Response Sensor Did Not Report It

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

A "block" of a malicious binary was executed by a 3rd party AV product, however when searching in the CB Response console, that malicious process is not found.

Environment

• CB Response:  All Versions

Cause

• CB Response sensor observes running processes and does not execute a file scan.  Since the 3rd party AV blocked the execution, the CB Response sensor will not observe/report any running processes associated with the malicious binary.
• The process that wrote the malicious binary can be found using filewrite_md5 (all versions) or filewrite_sha256 (in 6.3.1 or later) search parameters.  

Resolution

CB Response is working as designed.